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• Definition: having an impact in the real world 

• Key deliverers: JTRIG and CNE 

• Now major part of business - 5% of Operations 

• Across all target types 

• Continuous innovation of new tools and techniques 



Tli is information is exempt under the Freedom of Information Act 2000 (FQIA) and may be exempt under other UK information legislation. Refer any FQIA queries to GCI-KJ 
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CNIO 

Computer Network Information Operations 



• Propaganda 

• Deception 

• Mass messaging 

• Pushing stories 

• Alias development 

• Psychology 




Tills information is exempt under the Freedom of Information Act 2000 (FOIA) and may he exempt under other UK information legislation. Refer any FOIA queries to GCHQ 
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Disruption / CNA 



• Masquerades 

• Spoofing 

• Denial of service 

- Phones 

- Emails 

- Computers 

- Faxes 




This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information legislation. Refer any FOTA queries to GCHQ 
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Information Operations 

INFINITE CURVATURE/MOUNTAIN SLOPE 

Sending messages across the full spectrum of communications 



Telephony SMS FAX Email 







RADIUS Data -» 
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Data Mining 


Open 
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ROYAL CONCIERGE 

A SIGINT driven hotel reservation tip-off service 



From: reservations@expenslvehotet.com 
To: new-target@nnod.gov.xx 

“Thank you for reserving ” 



ROYAL CONCIERGE exploits these 
messages and sends out daily alerts to 
analysts working on governmental 
hard targets 

What hotel are they visiting? 

Is it SIGINT friendly? 




An enabler for effects - can we influence the hotel choice? Can we cancel their visit? 



We can use this as an enabler for HUMINT and Close Access Technical Operations 



This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information legislation. Refer any FOIA queries to GCHQ 
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Information Operations: The Social Web 






facebook 




11 



Deliver messages and multimedia content across Web 2.0 
Crafting messaging campaigns to go ‘viral’ 



This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information legislation. Refer any FOIA queries to GCHQ 
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Twitter TDI Development 



Need SIGINT coverage across protocols, 

Not necessarily consistent with target SIGDEV priorities 
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Twitter TDI Development 



Base64 + double encoded URL 
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Twitter TDI Development 



PPF application across 10G Environment 

1272671024 81 . 169 . 145.25 

128.242.240.20 6 55489 80 Login- 
twitter, com 31 solo_only@twitter.com 

TDI-Scope 4 User Route 13 
81 .169.145.25 HHFP-Hash 8 38 
4646d4 User-Agent 52 Twitter Tools 
Geo-IP-Src 28 

49.00;8.39;KARLSRUHE;DE;5MVV 
Geo-IP-Dst 33 39.0062;- 
77.4288;STERLING;U 
S;7LLM Event-security-labe! 6 1 0007F 
Stream-security-iabe! 10 400023E0FF 

Tit is information is exempt under the Freedom of Information Act 2000 (F 01 A) and 
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Twitter TDI Development 




Given a country: 

Who are the top Twitter 
Users ? 

Or given a user: 

Are they really in 
Kawestan? 



SIGDEV augments the 10 process to aid targeting and takeup of message 



Tliis information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information legislation. Refer any FOIA queries to GCHQ 
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Information Ops 

Spheres of Influence 




This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information legislation. Refer any FOIA queries to GCIIQ 
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Mobile Information Ops 




50 new mobile TDIs being 
Developed by end of 201 0 

Also - Target Geographical 
Identifiers (TGI) 



We can shape CNIO against 
specific locations, users with 
a high degree of cognition 



This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information legislation. Refer any FOIA queries to GCTIQ 
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CNA 

Vulnerability Assessment Process Development 



Enabling CNO For intelligence production teams, based on Target Templating methodology 



Tongel TemplBlmg ^ a hypothesis-based. 
OTiidhcftauvi? metrwddogy tor ^mng rework 
Qn&iv 5 is. Dy cuiiihijciini} o kniiear hvLKJUKitis rtoin 
your tsnorttedge gups, u (uigel IhrtiK) i= produced 
The thread is based on the understanding or f 3 
"Layers' ,,nrJerslandini] ihe Israel domain and how it 
oann«ts io ine gtonai rn>iwm*, enn inon 
untiersiQntJii'nj what opptmunieiss can bo «!tjjioited 10 



I.ifmi □rjiv-’-i L^yoi T oj Lilli rev tl'd walk How. anti wlmt nwxbi 
Id be done 10 achieve the >jutconte. Target Toinplutmy 
pmvdes that framework in order id bieak dcwt a problem 
into Ibis essenh^l parts necessary 1o dsvelnp access anrl 
rVilWOTk htVJWp'tOdflO V<.in)l.50.H0i* Of 1hl3 KltCrAldOgo <3l dll 
layers is essential to spoflirig linksges bolh honjonlolly 
jirro&s die loyeio and vomcsty through ihcm to sn^ use oi p 

visualisation package >Jr mig Lag nadf will Im lairttotiragea 



Information Need, 
Knowledge Gap 
Hypothesis 




Layer it T^rsret - An Enlity sueft os a 
person or organlKilicjn. 



Layer J; mrraatructure i-|nw 1ln> terflOf 
Mmmxti to Clio sjlobaf irnttVOIk 



Layer ■&: Technology - U riders, laj’ding ihe 
tertiggiogy 1 1» target ifMs io corwidntcaHe 



Layer 4: Vulnerabilities - Looking ■for 
vulnerabilibe?- in Pte technologies. 



Layer &: Capabilities - Can yre ejtploil Ihe 
yulnersbilibas? 



Layer ■£: Access - Wild? assets do we have 
to collar t Ihe Iraffic/ 



Layer 7: Eap natation. Planning, Delivery - 

How are we going to achreue the 
desired cniixinv^ 



For further information on Target Templating visit 
the GUILTY SPARK porta! on GCWiki 
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VA process delivered through 
NADP trained network analysts 



within each production team 



Tliis information is exempt under the Freedom of In formation Act 2000 (FOIA) and may be exempt under other UK information legislation. Refer any FQIA queries to GCHQ 
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Human Systems Analysis 

Foreign News Agencies: 

• Credential Harvesting 

• Employee Analysis 



SIGDEV 



- who? 

- how? 

- why? 




Data in 




New Data out 
► Data out 



Social not technological solution 

This information is exempt under the Freedom of Information Act 2000 (FQIA) and may be exempt under other UK information legislation. Refer any FOIA queries to GCHQ 
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Formalising Tradecraft for Analysts: 

“What SIGDEV needs to be 
done prior to starting an 
Effects operation?” 




Joining up with 5 EYES where possible (cyber development) 



BGP / MPLS network effects (HOTWIRE) 



SIP and VoIP Effects - Denial of Service, Psychological Operations 

Provide the defensive advice from the offensive perspective 

Th is information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information legislation. Refer any FOIA queries to GCHQ 
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Questions? 



r^m 

JTMG Head ofJTRIG 
NSTS:^^H 




Find me on TAPIOCA 



names and phone numbers redacted 
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